Splunk Search

How to share and manage searches across Splunk instances?

dougmartin
Path Finder

We have multiple Splunk instances (webui & indexer) that we manage. They're currently kept isolated by design. However, we're trying to figure out the best way to share searches and distribute searches between the instances with minimal effort.

Basically, we want to create a search/report on SplunkB and see it on SplunkA & SplunkC within a short time frame (0-15minutes would suffice). We'd also like the searches from SplunkA to show up on B&C.

Hopefully that makes sense.

0 Karma

woodcock
Esteemed Legend

Probably the easiest way is to make sure that everybody savers the searches, then upgrades the permissions of the saved searches to "app" so that each set of associated searches/alerts/KOs is contained inside specific apps. Then use this app to export the entire mess as a single zip file that can be installed on the other search head:

https://splunkbase.splunk.com/app/2613/

The only real downside is that this is a 1-way sync, not a 2-way, but I am assuming that you are talking about Dev->Production.

dougmartin
Path Finder

Yup, the 1-way sync would be a start.
A little worried about overwriting saved searches but something has to give since there is no great way to do this otherwise.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.